chore(iast): ast deny list

[avara1986]

Update the deny list of IAST AST patching. The objective of this PR is to improve the django startup applications

Checklist

• PR author has checked that all the criteria below are met
• The PR description includes an overview of the change
• The PR description articulates the motivation for the change
• The change includes tests OR the PR description describes a testing strategy
• The PR description notes risks associated with the change, if any
• Newly-added code is easy to change
• The change follows the library release note guidelines
• The change includes or references documentation updates if necessary
• Backport labels are set (if applicable)

Reviewer Checklist

• Reviewer has checked that all the criteria below are met
• Title is accurate
• All changes are related to the pull request's stated goal
• Avoids breaking API changes
• Testing strategy adequately addresses listed risks
• Newly-added code is easy to change
• Release note makes sense to a user of the library
• If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
• Backport labels are set in a manner that is consistent with the release branch maintenance policy

[github-actions]

CODEOWNERS have been resolved as:

ddtrace/appsec/_iast/_ast/ast_patching.py                               @DataDog/asm-python

[datadog-dd-trace-py-rkomorn]

Datadog Report

Branch report: avara1986/ast_denylist
Commit report: 0416a11
Test service: dd-trace-py

✅ 0 Failed, 1869 Passed, 212 Skipped, 41m 9.62s Total Time
❄️ 2 New Flaky

New Flaky Tests (2)

• test_cmdi - test_pygoat.py - Last Failure

  Expand for error

   assert False
    +  where False = vulnerability_in_traces('COMMAND_INJECTION', <requests.sessions.Session object at 0x7f24c04d4990>)
    +    where <requests.sessions.Session object at 0x7f24c04d4990> = <class 'tests.appsec.integrations.pygoat_tests.test_pygoat.client.<locals>.RetClient'>.agent_session
  

• test_sqli - test_pygoat.py - Last Failure

  Expand for error

   assert False
    +  where False = vulnerability_in_traces('SQL_INJECTION', <requests.sessions.Session object at 0x7f24c042c290>)
    +    where <requests.sessions.Session object at 0x7f24c042c290> = <class 'tests.appsec.integrations.pygoat_tests.test_pygoat.client.<locals>.RetClient'>.agent_session
  

[pr-commenter]

Benchmarks

Benchmark execution time: 2024-09-13 07:33:27

Comparing candidate commit 0416a11 in PR branch avara1986/ast_denylist with baseline commit de9f33b in branch main.

Found 0 performance improvements and 0 performance regressions! Performance is the same for 48 metrics, 0 unstable metrics.

[juanjux]

Blocking for now. I don't see the logic of banning all these modules, some of them look like could have propagation if properly patched, so I want to discuss that first.